CVE-2026-22028 Preact has JSON VNode Injection issue

Preact, a lightweight web development framework, JSON serialization protection to prevent Virtual DOM elements from being constructed from arbitrary JSON. A regression introduced in Preact 10.26.5 caused this protection to be softened. In applications where values from JSON payloads are assumed t...

CVE-2026-22028

CVE-2026-22028 affects Preact where a regression in 10.26.5 weakened JSON serialization protection, allowing JSON payloads to be mis-parsed as valid VNodes and potentially leading to HTML injection and script execution if CSP or other mitigations are not in place. Affected versions include 10.26....

Access of Resource Using Incompatible Type ('Type Confusion')

Overview org.webjars.npm:preact is a fast 3kB alternative to React with the same modern API. Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' during rendering in the vnode constructor. An attacker can inject arbitrary HTML or execute...

CVE-2019-16216

Zulip server before 2.0.5 incompletely validated the MIME types of uploaded files. A user who is logged into the server could upload files of certain types to mount a stored cross-site scripting attack on other logged-in users. On a Zulip server using the default local uploads backend, the attack...

CVE-2025-1763

An issue has been discovered in GitLab EE that allows for cross-site-scripting attack and content security policy bypass in a user's browser under specific conditions, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1...

PT-2026-2136

Name of the Vulnerable Software and Affected Versions Preact versions 10.26.5 through 10.26.9 Preact versions 10.27.0 through 10.27.2 Preact versions 10.28.0 through 10.28.1 Description Preact, a lightweight web development framework, has an issue with JSON serialization protection. A regression...

EUVD-2025-206236

vega-functions vulnerable to Cross-site Scripting via setdata function...

UBUNTU-CVE-2025-66648

vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use of an internal function not part of the public API could be used to run unintentional javascript XSS. This issue is...

CVE-2025-66648 `vega-functions` vulnerable to Cross-site Scripting via `setdata` function

vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use of an internal function not part of the public API could be used to run unintentional javascript XSS. This issue is...

WordPress Cookies and Content Security Policy plugin <= 2.34 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by MD ISMAIL in WordPress Plugin Cookies and Content Security Policy versions = 2.34...

EUVD-2026-0827

PLANKA 2.0.0 lacks X-Frame-Options and CSP frame-ancestors headers, allowing the application to be embedded within malicious iframes. While this does not lead to unintended modification of projects or tasks, it exposes users to Phishing attacks. Attackers can frame the legitimate Planka applicati...

CVE-2025-65922

CVE-2025-65922 affects PLANKA 2.0.0. The issue is missing X-Frame-Options and CSP frame-ancestors headers, allowing the app to be embedded in malicious iframes which could enable UI redressing and phishing on overlay forms. The supplier disputes the risk, citing SameSite=Strict cookies and cross-...

Planka 安全漏洞

Planka is a Trello-like Kanban board built with React and Redux by Planka Open Source. A security vulnerability exists in Planka version 2.0.0, which stems from the missing X-Frame-Options and CSP frame-ancestors headers and could lead to a phishing attack...

PT-2026-1340

Name of the Vulnerable Software and Affected Versions vega-functions versions prior to 6.1.1 Description vega-functions provides function implementations for the Vega expression language. For sites accepting untrusted user input, a malicious actor could exploit an internal function to execute...

XSSREFLECTOR

XSS Reflector XSS Reflector adalah tools otomatis untuk...

CVE-2025-40891

A Stored HTML Injection vulnerability was discovered in the Time Machine Snapshot Diff functionality due to improper validation of network traffic data. An unauthenticated attacker can send specially crafted network packets at two different times to inject HTML tags into asset attributes across t...

CVE-2025-40893

A Stored HTML Injection vulnerability was discovered in the Asset List functionality due to improper validation of network traffic data. An unauthenticated attacker can send specially crafted network packets to inject HTML tags into asset attributes. When a victim views the affected assets in the...

CVE-2025-59849

Improper management of Content Security Policy in HCL BigFix Remote Control Lite Web Portal versions 10.1.0.0326 and lower may allow the execution of malicious code in web pages...

CVE-2025-40891

A Stored HTML Injection vulnerability was discovered in the Time Machine Snapshot Diff functionality due to improper validation of network traffic data. An unauthenticated attacker can send specially crafted network packets at two different times to inject HTML tags into asset attributes across t...

CVE-2025-40893

A Stored HTML Injection vulnerability was discovered in the Asset List functionality due to improper validation of network traffic data. An unauthenticated attacker can send specially crafted network packets to inject HTML tags into asset attributes. When a victim views the affected assets in the...